CVE-2024-50341

What it actually does

The configured user_checker on a firewall is bypassed during programmatic authentication via the Security::login method, allowing logins that should have been rejected by custom user validation logic.

Why it matters to the business

Attackers or malicious insiders can obtain authenticated sessions for accounts that should be blocked by existing user checks, increasing the risk of unauthorized access across Symfony applications.

How an attack unfolds

An attacker invokes the Security::login method directly in application code or via a vulnerable endpoint to authenticate a user account; because the firewall's user_checker is never invoked, any pre-login validation (account status, custom bans, etc.) is skipped and the session is created anyway.

How to fix it

Upgrade symfony/security-bundle (and the symfony/symfony monorepo) to versions 6.4.10, 7.0.10, or 7.1.3 or later; the patch ensuring user_checker execution is included in commit 938c0728518f9df199477d90ee43838359f81a7a. No workarounds exist.

How to confirm the fix worked

After upgrade, confirm the Symfony version meets or exceeds the fixed releases and exercise the Security::login path while verifying that the user_checker is now invoked (via custom logging or unit tests).

Typical attack path

1. Identify an application endpoint or code path that can trigger Security::login with attacker-controlled credentials
2. Supply a user identity that would normally be rejected by the configured user_checker
3. Call the login method; the missing checker invocation results in a valid authenticated session
4. Use the resulting session to access protected resources

How to detect it

Review application logs and authentication flow traces for Security::login invocations that do not produce corresponding user_checker activity; compare timestamps of login events against any custom checker audit logs.

What your security team should do

• Immediately upgrade all Symfony installations to the fixed versions listed above
• Audit application code for any direct use of Security::login and ensure it is covered by the updated bundle
• Review firewall configurations to confirm user_checker definitions remain effective post-upgrade
• Monitor EPSS and KEV updates; although currently low, re-evaluate if exploit maturity changes